General

  • Target

    84422771272659cf5af123809e4de756e6770ba6b5df938bd3bf59fce5cf6d0dN.exe

  • Size

    433KB

  • Sample

    241112-k2ghsasmaj

  • MD5

    b10c450f52de1b76c14bc057a57022f2

  • SHA1

    ad01af3b223018a94bb36dd8f2724fd96afff734

  • SHA256

    0612bdf40a3cb209ca576680501ee8e1cd2155159442f643e8c5ff3c29848414

  • SHA512

    34f37a489dcedc364923c12162165323246788e63fbc831186f3b9c223204276347a9a801078cd7bfe1c4abb319d2802e92cbf259ff5badf07ea4ad88d30c6f4

  • SSDEEP

    12288:yMrqy90JWCWbxy59C7a3Y3PfMLmW4gg5O:IyqWCWbsrC7a3YffMKWpg5O

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Targets

    • Target

      84422771272659cf5af123809e4de756e6770ba6b5df938bd3bf59fce5cf6d0dN.exe

    • Size

      433KB

    • MD5

      b10c450f52de1b76c14bc057a57022f2

    • SHA1

      ad01af3b223018a94bb36dd8f2724fd96afff734

    • SHA256

      0612bdf40a3cb209ca576680501ee8e1cd2155159442f643e8c5ff3c29848414

    • SHA512

      34f37a489dcedc364923c12162165323246788e63fbc831186f3b9c223204276347a9a801078cd7bfe1c4abb319d2802e92cbf259ff5badf07ea4ad88d30c6f4

    • SSDEEP

      12288:yMrqy90JWCWbxy59C7a3Y3PfMLmW4gg5O:IyqWCWbsrC7a3YffMKWpg5O

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks